Cisco Catalyst SD-WAN Manager API authentication bypass: mishandled URL encoding gives unauthenticated attackers admin access

Who is affected

Cisco says Catalyst SD-WAN Manager is affected regardless of system configuration, and that systems with ports exposed to the internet are at risk of compromise.

Caveats:

The table above follows the fixed-release table in Cisco’s advisory. The CVE record, also filed by Cisco (updated 2026-10-02), presents the versions differently. The two primary sources disagree, so this page lists both and does not choose between them:

• How the CVE record lists versions. Instead of a version range, the record itemizes affected versions one by one, from 17.2.4 through 18.x, 19.x, 20.x and 26.x, including 20.9.x, 20.12.x, 20.15.x, 20.18.x, 26.0.1 and 26.1.x. Versions not listed have the status “unknown” (defaultStatus: unknown).
• Trains missing from the advisory table. Cisco’s advisory fixed-release table does not list the 20.10, 20.11, 20.13, 20.14 or 20.16 trains (The Hacker News also points this out and says Cisco’s May advisory did list them). The CVE record lists versions such as 20.10.1, 20.11.1, 20.13.1, 20.14.1 and 20.16.1 as affected. Cisco’s advisory does not say which release these trains should upgrade to.
• The 26.0 train. Cisco’s advisory fixed-release table has no 26.0 train, and 26.0 is not “earlier than 20.9”; the CVE record lists 26.0.1 as affected. If you run 26.0.x, ask Cisco.
• Builds derived from fixed releases. The CVE record also lists as affected some builds whose names are based on fixed releases, such as 20.9.10.1.01, 20.12.8.2.01, 20.15.6.1.01, 20.18.4.1.01 and 26.1.2.1.01, plus 26.2.1_LI_Images, 26.1.2.1_LI_Images, 20.15.6.1_LI_Images and 20.18.4.1_LI_Images. The CVE record marks no version as unaffected. The advisory, by contrast, names 20.9.10.1, 26.2.1 and so on as first fixed releases. No source explains the difference. If you run one of these builds, check with Cisco.

How it works

SD-WAN Manager offers an API (an interface other programs use to send it commands over the network) and uses “sessions” (a credential you get after logging in) to control who can use it. One authentication rule exists specifically to restrict access to a particular API endpoint.

The problem is URL encoding: characters in a web address can be rewritten as ”%” plus digits, so the same path can be written several ways. Cisco says the system mishandles URL encoding in HTTP requests, letting a crafted request slip past that authentication rule and end up accessing the API as the admin user. Cisco classifies this as CWE-177 (Improper Handling of URL Encoding). The attacker needs no login and no user interaction.

The sources provided give no technical detail beyond Cisco’s one-sentence description. Below is a common illustration of this kind of weakness, written by PlainCVE; it is not Cisco’s code:

The flawed approach (conceptual illustration):

# The rule is checked against the still-encoded path
if matches_protected_rule(request.raw_path):
    require_login()
# but routing uses the decoded path
route(url_decode(request.raw_path))

The fixed approach (conceptual illustration):

# Decode and normalize once; check and route on the same value
path = normalize(url_decode(request.raw_path))
if matches_protected_rule(path):
    require_login()
route(path)

What a successful attack achieves: Cisco says admin-level access to the API. Researchers at Horizon3.ai add that the admin user holds the netadmin role by default, which permits all operations, but Cisco’s advisory does not say this. No source says the flaw leads to code execution on the underlying operating system.

Timeline

No source says when exploitation actually began.

Further reading

• Scoring: Cisco rates it CVSS 3.1 9.8 (Critical).
• Zero-day or not: The Hacker News calls it a zero-day (exploited before a fix existed), and security firm Field Effect says attackers were targeting vulnerable systems before updates were available. Cisco’s advisory itself does not use that term; it only says Cisco learned of exploitation in September.
• Attack details not public: According to The Hacker News, Cisco’s advisory does not say when attacks began, who carried them out, how many customers were hit, or what the attackers did with their access. KEV lists known ransomware use as “Unknown”.
• How it was found: The Source section of Cisco’s advisory says the vulnerability was found while a Cisco TAC support case was being resolved (The Hacker News reports the same). The CVE record lists the discovery source as external (EXTERNAL).
• Cisco bug ID CSCww79570; weakness type CWE-177.